I'm trying to setup my rsyslog to send logs generated by an application under /opt/appname/logs to a remote syslog server. I have already configured rsyslog to send OS level logs but wanted to see if it can also send logs of an application. I'm not sure if IncludeConfig directive works as it looks for another *.conf file.

  • Does the application do its logging via syslog?
    – MadHatter
    Dec 16, 2013 at 14:36
  • I don't think so. This is a tomcat based application and dumps logs to a directory. I wanted them to be fed to a SIEM based application so that we see ALL of them on a central console.
    – Lego
    Dec 16, 2013 at 14:40
  • Check if the application uses some established logging framework like log4j and can be configured to use syslog. That would be the best way. Otherwise +1 for Jenny D's answer with "imfile".
    – mschuett
    Dec 16, 2013 at 15:30

3 Answers 3


rsyslog has support for reading from a file. This is done with the imfile module. You need the following config:

module(load="imfile" PollingInterval="10") #needs to be done just once

# needs to be done for each file you want to watch
input(type="imfile" File="/path/to/file1" 

There's more information at the rsyslog documentation site


You can always use the old syntax:

eg. /etc/rsyslog.d/11-your-file.conf

$ModLoad imfile

$InputFileName  /app/your-file.log 
$InputFileTag   your-tag
$InputFileStateFile     your-tag 
$InputFileSeverity      info
$InputFileFacility      local7 
$InputFilePersistStateInterval 1000 
local7.*  @@remote-rsyslog-server:port

If you hook a startup script you can use can combine

tail -n 0 -F /opt/appname/logs/file | logger ... 

The parameters for logger would be the priority and you could specify the remote syslog server or just use local setup and have rsyslog do the forwarding for you.

A con for this setup is that you must make sure you're tailing the log as your application starts or you'd miss records in between.

A better solution, but gives more work, would be to use something like logstash.

You configure the inputs according to your application logs, for file you can use sincedb to have it continue from where it last stopped and you have a module to output to syslog.

Depending on what you want this might be too much work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.